On: 15 years later: remote code execution in qmail

[tedunangst]

What did Debian change to introduce this vulnerability?

[dsr_ → tedunangst]

Nothing, per se. But they don't set up softlimits or message size limits by default, both of which you should definitely do... it's just that the values you put in are specific to your situation.

[tom_mellior → dsr_]

If you have DJB's ego yelling at you that the default configuration is safe, why would you bother setting limits to fix it?

[dependenttypes → tom_mellior]

DJB has been telling people to run it with the memory limits since 2005.

[jacquesm → tom_mellior]

Because you care more about the users than about DJB's ego.

[haroldp → jacquesm]

Then you should be running Postfix.